Nativekeel
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| NATIVEKEEL_MCP_ROOTS | No | Set this when your MCP client starts servers from another folder. The server is read-only and scans folders under the directory it was started in, plus the folders listed in NATIVEKEEL_MCP_ROOTS. When the server is started inside a plugin folder (Codex), your home folder is the boundary unless NATIVEKEEL_MCP_ROOTS is set. |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| scan_projectA | Health check for a React Native or Expo project: upgrade blockers, New Architecture, Google Play and App Store rules (target SDK, 16 KB pages, Xcode 27 UIScene, privacy manifests), crash risks, accessibility (unlabeled icon buttons and text fields, small touch targets, low text contrast, text scaling), OWASP MASVS security findings, leaked secrets, and signs of malware planted in the project or known malware anywhere in its lockfile dependency tree (run it before installing or starting a project you did not write). Use this for a general "how healthy is this app" or "what is wrong with it" question; it covers every area at a glance. For a deeper security review with attacker prerequisites use security_audit; for "should we upgrade" use upgrade_readiness. Read-only, never runs project code; returns findings with file:line references and fixes, never source code. |
| security_auditA | Review mobile app data exposure, account access, unsafe code execution, backend rules and dependency risks. Returns source evidence, attacker prerequisites, fixes, validation steps and explicit coverage limits. Use this when the question is specifically about security ("can this app be hacked", "is user data safe", before a security review or release); it goes deeper than the security part of scan_project and explains what an attacker would need for each finding. For an overall health check use scan_project. Static and read-only; does not claim a live penetration test or a clean bill of health. |
| improve_appA | Prioritize existing security, crash, accessibility, performance, store and dependency findings into a review plan with prerequisites, expected effects and validation. Use this when someone asks what to fix first or how to make the app better overall, across all areas. Do not use it for upgrade questions: use upgrade_readiness for whether to upgrade and upgrade_plan for the upgrade steps. No project code runs, no automatic changes or unmeasured performance claims. Reports unassessed areas explicitly. |
| measure_bundleA | What the release JavaScript bundle of a React Native or Expo app is made of, measured from the source map a release build already wrote (Hermes bytecode maps included): bytes and share for the app code and each package, packages bundled more than once, and the largest JSON. With base (an older map), what was added, removed or changed size since that build. Nothing is built or run; returns found:false with how to produce a map if there is none. |
| upgrade_planA | Ordered, step-by-step upgrade plan for a React Native or Expo project: phases in the order to do them (security fixes, crash risks, store deadlines, React Native and Expo upgrades, library replacements), the reason for each phase and concrete steps with file names. Use this once the decision to upgrade is made and the user wants the work in order; call upgrade_readiness first for the go/no-go. For non-upgrade priorities use improve_app. Built from the same scan as scan_project; stops with a warning if the project contains planted malware. Read-only. |
| upgrade_readinessA | Go/no-go for upgrading a React Native or Expo project to the newest version: a verdict (ready, blocked, a multi-version jump, or already current), the exact breaking changes in the project's own code and dependencies with file and line, behavior and tooling changes to review, and an honest list of what a static scan cannot confirm. Use this first when someone asks whether or how to upgrade; use upgrade_plan for the full ordered steps. Built from the same scan as scan_project. Read-only. |
| check_libraryA | What to know about one React Native library before adding or upgrading it: latest version, New Architecture support and maintenance status (React Native Directory), the version range that works with a given React Native version where NativeKeel has a compatibility table, replacements, and known traps. |
| explain_errorA | Explain a React Native or Expo build, launch, crash or store-review error: what it means and the fix, from errors NativeKeel has reproduced or verified against Apple, Google, Expo and React Native documentation. Pass the error message (or the failing part of the log) and, optionally, the project path to see where this project is affected. Call it before searching the web or changing versions. |
| verify_upgradeA | Check a change before committing it: compares the React Native or Expo project as committed at a git revision (default HEAD) with the working tree, and lists what got fixed, what is new and how versions moved. Call it after an upgrade or a dependency change. Read-only: the committed version is unpacked into a temporary folder outside the project and deleted. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 9 tools
The descriptions do heavy lifting: scan_project, security_audit, improve_app and upgrade_readiness all derive from the same scan and could easily blur together, but each explicitly states when to prefer another tool ('use security_audit for deeper', 'use upgrade_readiness first'). Boundaries between upgrade_readiness, upgrade_plan and improve_app are deliberate and readable, though the scan/security/improve trio still requires careful reading.
All tools use snake_case and the names are short and readable, with a clear upgrade_* family. There is a minor deviation in verb placement: explain_error, scan_project, check_library, measure_bundle and verify_upgrade are verb_noun, while security_audit, upgrade_plan and upgrade_readiness are noun-first.
Nine tools is well within a comfortable range, and each covers a distinct stage of the diagnostic/upgrade workflow (error help, scan, deep audit, prioritization, go/no-go, plan, library lookup, bundle, verification). No filler tools are apparent.
The surface covers the lifecycle from understanding an error through scanning, deciding on an upgrade, planning and verifying it, plus library and bundle inspection. Gaps are minor: no tool addresses runtime/performance measurement or store-metadata generation, and everything is read-only by design, so fixes cannot be applied.